[LU-12826] Project quotas: users can change project IDs

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.14.0, Lustre 2.12.4
• Affects Version/s: Lustre 2.12.2
• Environment: CentOS 7.6, ldiskfs, 2.12.2_116+3
• Severity: 3
• Assignee: Wang Shilong (Inactive)
• Reporter: Stephane Thiell

Description

We're considering using project quotas in the future but we noticed that users can change or clear the project id of their own files/directories. How can we restrict access to project IDs only to admins (like ext4 does I guess?). We looked at the manual but couldn't find how permissions are handled. Sorry if we missed something obvious.

 

[root@fir-io7-s2 users]# ls -ld /firhdr/users/sthiell
drwxr-x--- 4 sthiell root 4096 Sep 30 20:30 /firhdr/users/sthiell
[root@fir-io7-s2 users]# lfs project -d /firhdr/users/sthiell
   10 P /firhdr/users/sthiell

[root@fir-io7-s2 users]# su -m sthiell

bash-4.2$ cd  /firhdr/users/sthiell
bash-4.2$ lfs project -C .
bash-4.2$ lfs project -d .
    0 - .

Issue Links

• is related to: LU-11303 slow chgrp as user when quotas are enabled